1) The document discusses setting up a virtual SDN network using Mininet and Open vSwitch to study DDoS attack detection using machine learning. It creates a 3-switch topology and configures basic flow rules. 2) A DDoS ping flood attack is launched on the network from multiple hosts. Network traffic data is collected using sFlow for both normal and attack scenarios. 3) Different machine learning classifiers including Bayes Net, Naive Bayes, and AdaBoost are trained on the data and their performance is compared based on metrics like precision, recall and F-measure. AdaBoost performed the best with 0.934 precision and recall.

1. Leveraging Machine Learning Approach to
Setup Software Defined Network(SDN)
Controller Rules During DDoS Attack
Authors
Sajib Sen, Kishor Datta Gupta, and Md Manjurul Ahsan
4/30/18 1

2. Introduction
Figure 1: Different planes and network
application in SDN[1]
Figure 2: Reactive traffic flow set-up in
SDN[1]
[1]Niyaz Q, Sun W, Javaid AY, and Alam M. A deep learning approach for network intrusion detection system. International conference wireless networks and mobile communications (WINCOM),
pages 258{263, 2016

3. Introduction
Figure 3: OpenVSwitch architecture
Figure 4: Packet flow

4. Introduction
Figure 5: sFlow-RT interface

5. Introduction
Figure 6: Traffic monitoring Figure 7: Event handling

6. Implementation:
• To create a virtual network SDN topology:
• sudo mn --controller=remote,ip=127.0.0.1,port=6653 --topo=single,3 --mac --switch ovsk
• This tells Mininet to start up a 3-host, single-(openvSwitch-based)switch topology, set the MAC
address of each host equal to its IP, and point to a remote controller which defaults to the localhost.

7. Implementation:
Figure 8: Setting of Virtual SDN

8. Flow rules set up in SDN controller:
# sudo ovs-ofctl add-flow s1 in_port=1,actions=output:2
# sudo ovs-ofctl add-flow s1 in_port=2,actions=output:1
This will forward packets coming at port 1 to port 2 and vice-verca.

9. Implementation:
• To connect OpenVSwitch to sFlow-RT analyzer:
• sudo ovs-vsctl -- --id=@sflow create sflow agent=eth0 target="127.0.0.1:6343" sampling=10
polling=20 -- -- set bridge s1 sflow=@sflow
• Here the OpenVSwitch has been connected to sFlow-RT with eth0 as agent and flow switch as s1.
• To start: ./sFlow-rt/start.sh and to check the topology of mininet network in sFlow-RT need to visit
• http://localhost:8008/metric/127.0.0.1/html
• http://localhost:8080/ui/pages/index.html

10. Implementation:
• xterm h1 h2
• on h1 terminal "python -m SimpleHTTPServer 80&
• on h2 terminal "ping 10.0.0.1"
Figure 9: Ping request to node h1

11. Implementation:
Figure 10: Network packet information in Wireshark

12. Implementation:
Figure 11 : Packet flow in s1-eth0 interface

13. Implementation:
Data Description:
No. Features Description
1 Service network service on the destination, e.g., http,
telnet, etc.
2 Header length Length of Header data
3 Flags normal (0) or error(1) status of the connection
4 TTL Time to Live
5 Protocol type of the protocol, e.g. tcp, udp, etc.
6 Data bytes Bytes of data needed for certain protocol
7 Epoch Time Time to complete one epoch
8 Reply Response
Time
Time to give response
9 Land 1 if connection is from/to the same host/port; 0
otherwise

14. Implementation:
• DDoS flood attack:
• ping -f 10.0.0.1 command from different MiniNet hosts.
• Besides to create flood attack manually, a payload had been created by python code using scapy
library.
Figure 12: DDoS Attack

15. Implementation:
Figure 13: Ping flood attack to node h1

16. Implementation:
Figure 14: Ping flood packet data in wireshark

17. Figure 15: Dos attack in sFlow-RT
Implementation:

18. No Techniques Precision Recall F- Measure ROC Area
1 Bayes Net 0.889 0.885 0.885 0.863
2 Naïve
Bayes
0.731 0.705 0.693 0.707
3 Multilayer
Perceptron
0.836 0.836 0.836 0.834
4 Support
Vector
Machine(ker
nel=3)
0.853 0.852 0.852 0.853
5 AdaBoost
(Decision
Stump as
weak
classifier)
0.934 0.934 0.934 0.887
6 J48 decision
tree
0.903 0.902 0.901 0.880
7 Random
Forest
0.837 0.836 0.836 0.899
Result and Observation:

19. 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
Bayes Net
Naïve Bayes
Multilayer Perceptron
Support Vector Machine(kernel=3)
AdaBoost(Decision Stump as weak classifier)
J48 decision tree
Random Forest
Comparison of F-measure Among Classifier
Result and Observation

20. • Virtual SDN testbed environment has been created
• DoS attack performed on the network
• Data collected for both normal and attack scenario.
• Model trained and performance compare for different classifier
Conclusion

21. Thank you
4/30/18 21